JSON Web Tokens (JWT)

Cross-platform resources for JSON Web Tokens (JWT): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

JSON Web Tokens (JWT)

This page aggregates cross-platform resources to practice JSON Web Tokens (JWT): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/jwt

HTB machines practicing JSON Web Tokens (JWT) (10)

Machine	OS	Difficulty
Backend	Linux	MEDIUM
BackendTwo	Linux	MEDIUM
Breadcrumbs	Windows	HARD
Epsilon	Linux	MEDIUM
Noter	Linux	MEDIUM
OverGraph	Linux	HARD
Player	Linux	HARD
Secret	Linux	EASY
TheNotebook	Linux	MEDIUM
Unicode	Linux	MEDIUM

PortSwigger labs practicing JSON Web Tokens (JWT) (8)

Lab	Difficulty	Topic	Official
JWT authentication bypass via algorithm confusion	APPRENTICE	JWT (JSON Web Tokens)	Open
JWT authentication bypass via algorithm confusion with no exposed key	APPRENTICE	JWT (JSON Web Tokens)	Open
JWT authentication bypass via flawed signature verification	APPRENTICE	JWT (JSON Web Tokens)	Open
JWT authentication bypass via unverified signature	APPRENTICE	JWT (JSON Web Tokens)	Open
JWT authentication bypass via jku header injection	PRACTITIONER	JWT (JSON Web Tokens)	Open
JWT authentication bypass via jwk header injection	PRACTITIONER	JWT (JSON Web Tokens)	Open
JWT authentication bypass via kid header path traversal	PRACTITIONER	JWT (JSON Web Tokens)	Open
JWT authentication bypass via weak signing key	PRACTITIONER	JWT (JSON Web Tokens)	Open

---

← Back to the full glossary

Last updated: 2026-06-07